Read the docs
TI-2015-01644 Aliases CVE-2015-1831GHSA-q2cg-xf9p-h457

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors.

Why it matters now

EPSS 0.06319 93rd percentileScored 2026-11-07
Fix Fixed org.apache.struts:struts2-core (Maven): 2.3.20.1org.apache.struts.xwork:xwork-core (Maven): 2.3.20.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.struts:struts2-core (Maven)2.0.0 to before 2.3.20.12.3.20.1Patch availableGHSA-q2cg-xf9p-h457
—org.apache.struts.xwork:xwork-core (Maven)2.0.0 to before 2.3.20.12.3.20.1Patch availableGHSA-q2cg-xf9p-h457
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.struts:struts2-core (Maven) Vendor— Affected 2.0.0 to before 2.3.20.1 Fixed in 2.3.20.1 Patch available GHSA-q2cg-xf9p-h457
  • org.apache.struts.xwork:xwork-core (Maven) Vendor— Affected 2.0.0 to before 2.3.20.1 Fixed in 2.3.20.1 Patch available GHSA-q2cg-xf9p-h457

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:*2.3.20VulnerableApache
  • cpe:2.3:a:apache:struts:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·Apache

Remediation

  • Fix · GHSA-q2cg-xf9p-h457 org.apache.struts:struts2-core (Maven) Fixed in 2.3.20.1 Advisory →
  • Fix · GHSA-q2cg-xf9p-h457 org.apache.struts.xwork:xwork-core (Maven) Fixed in 2.3.20.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-1831
  2. 2026-10-03 Alias added: GHSA-q2cg-xf9p-h457

References

Advisory 2

Other 2

  • TI-2020-13278 Expression language injection in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-07171 Improper input validation in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02013 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL… KEVCVSS 3.1CRITICAL 9.8
  • TI-2012-00357 The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter… KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-08433 Improper input validation in Apache Struts KEVCVSS 3.1HIGH 8.1
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences